This commit adds a new --block option to the server example to
illustate in a simplified way the general structure one would use to
implement IP address blocking with the new accept/reject/retry API.
For example:
cargo run --example server ./ --listen 127.0.0.1:4433 --stateless-retry --block 127.0.0.1:8065
cargo run --example client https://127.0.0.1:4433/Cargo.toml --host localhost --bind 127.0.0.1:8065
One thing to note is that that example places the reject condition
before the retry condition. This expends slightly less effort rejecting
connections, but does create a blocked IP address oracle for an attacker
who can do address spoofing.
Currently, when trying to run the client example with an IPV6 address
URL, such as by running:
cargo run --example client https://[::1]:4433/Cargo.toml --host localhost
A "failed to lookup address information: Name or service not known"
error is raised. This is because `url.host_str()` is `"[::1]"`, which
is wrapped in brackets. These brackets, specified by by RFC 2732, are
part of the URL syntax, not the IP address syntax.
Although this code succeeds, because the standard library treats this
like a URL:
use std::net::ToSocketAddrs;
"[::1]:4433".to_socket_addrs()
This code does not:
use std::net::Ipv6Addr;
"[::1]".parse::<Ipv6Addr>()
As the stdlib expects to just receive "::1". Consequentially, this
does not succeed, counterintuitively:
use std::net::ToSocketAddrs;
("[::1]", 4433).to_socket_addrs()
This code fixes the client example's URL parsing behavior by
stripping out such brackets in the same way as [is done in
tokio-tungstenite][1].
[1]: https://github.com/snapview/tokio-tungstenite/blob/052d085aff4708b924b92becaa83923b15045841/src/lib.rs#L404
Improves consistency with Endpoint::connect and removes the
possibility of silent blocking should the user pass in a domain
name. The generic API was originally motivated by the convenience of
passing in numeric addresses as strings, but `.parse().unwrap()` is
pretty easy too.
Dirkjan Ochtman